Re: Regarding proxy autoconfiguration in polipo

On Tue, Jan 19, 2010 at 11:30 PM, Juliusz Chroboczek
<[email protected]> wrote:
>>     Related to the same question: is there any other (recommended)
>> solution to obtain some kind of "layer 7 routing" for HTTP?
>
> If you want to do the proxy selection in the user-agent, then there's
> the proxy.pac mechanism, and also a FireFox extension called "FoxyProxy"
> (which is what I use).

    I know about them. (I lately I use almost exclusively PAC scripts
as they see more powerful.)

>>     I mean is there any SOCKS / HTTP proxy server (which can be put
>> upstream of Polipo), that allows this kind of "routing" of connections
>> (requests) based on rules (destination IP (in case of SOCKS) or URL
>> based (in case of HTTP))?
>
> I think it would be a worthwile addition to Polipo.  The trouble is that
> it would require designing some sort of configuration language, which is
> always a pain.
>
> Note that proxy.pac is not a suitable format, since it requires having
> a full Javascript interpreter in the proxy, and doesn't allow static
> analysis of the rules.
>
>                                        Juliusz


   Agree that no JavaScript engine should be included in Polipo.
   Even more I would prefer a simple language with a simple semantic.

   For example a list of rules, each rule stating either `deny`,
`direct`, `proxy <upstream-proxy-address>` or `socks
<upstream-socks-address>`. the matching should be simple: IP (either
netmask or CIDR based) + Port or regular expression for a host + PORT
(maybe range), plus a regular expression for the URL. (Maybe also a
distinction based on HTTP method). (Regular expressions are delimited
by `^` and `$`). (A `!` prefix before any part should mean negation.)

    Syntax:
<rule> := <not>?<method> <not>?<host-or-ip>:<not>?<ports> <not>?<url> <action>
<method> := get | put | post | connect | ... # case insensitive
<host-or-ip> := <host> | <ip>
<host> := <re> | <string> # case insensitive
<ip> := <dot_notation>/<bit_length> | <dot_notation>/<dot_notation>
<ports> := <number> | <number>,<number>,... | <number>-<number>
<url> := <re> | <string>
<re> := ^...$
<string> := "..."
<not> := !
<action> := deny | <proxy> | <socks>
<proxy> := proxy <host-or-ip>:<port> # user name and password?
<socks> := socks <host-or-ip>:<port> # user name and password?

    Example (content of a special file, named `routing`:
~~~~
* ^.*\.google\.com$ * direct
get *:* * proxy 127.0.0.1:9999
* 127.0.0.1/32:* * direct
* localhost:* * direct
* *:* * deny
~~~~

    As general rules, maybe:
    * matching should be done based only on the request line (not the headers);
    * matching should be quick;
    * no `and`, `or`, and other logical operators; (or?)
    * no DNS requests for translating between name to IP; (IP rules
match only against URL's pointing at IP's;)
    * maybe chains? (like iptables?) (maybe not in v1?)

    For more elaborate things maybe Privoxy or something similar might
be useful. (Content update, header removal, etc.)

    Any comments?

    Ciprian.

------------------------------------------------------------------------------
Throughout its 18-year history, RSA Conference consistently attracts the
world's best and brightest in the field, creating opportunities for Conference
attendees to learn about information security's most important issues through
interactions with peers, luminaries and emerging and established companies.
http://p.sf.net/sfu/rsaconf-dev2dev
_______________________________________________
Polipo-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/polipo-users